- Freeradius-Users - lists.freeradius.org

Re: coa / proxy question
by Richard J Palmer 06 Jan '14

06 Jan '14

That sounds perfect I will give that a go - I may come back with a couple more questions but it seems simple enough. Thanks for the pointers -- Richard Palmer > --- Original message --- > Subject: Re: coa / proxy question > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Date: Monday, 06/01/2014 3:29 PM > > Richard J Palmer wrote: >> >> What I would ideally like to do (simple solution) is send the coa >> request to both LNS routers - one will obviously say 'no match' the >> other will correctly affect the session. With the pool set to failover >> I >> find that second LNS is not sent the coa as the first LNS replied >> (albeit saying no match), load balance works 50/50. > > That's a terrible solution. > >> >> Is there a simple way to configure coa to send the request to both >> here. > > No. Packets go to ONE destination, and ONLY one destination. > >> >> I'm also open to any betrter routes to do this > > Add a column to the accounting table. It should be "LNS IP > Address". > Then, update the accounting queries to store Packet-Src-IP-Address > there. > > For CoA, you just look up the session in the accounting table, and > sent the CoA packet to the LNS IP Address. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

coa / proxy question
by Richard J Palmer 06 Jan '14

06 Jan '14

We have a setup for l2tp ADSL and other connections using freeradius. All is generally working fine - I am building some coa functionality. The good news is that this in general works fine - I have however one problem and while I can see hints on the list and on the freeradius site I would appreciate some clarification. We have currently 2 LNS Servers. Sessions to us can end up on either one of our LNS Servers. However I can't easily say which of the LNS devices to send the request to - the NAS IP we hold in radact is actually the Wholesale providers NAS IP not the LNS IP address. What I would ideally like to do (simple solution) is send the coa request to both LNS routers - one will obviously say 'no match' the other will correctly affect the session. With the pool set to failover I find that second LNS is not sent the coa as the first LNS replied (albeit saying no match), load balance works 50/50. Is there a simple way to configure coa to send the request to both here. I'm also open to any betrter routes to do this coa config is currently --- listen { type = coa ipaddr = * port = 3799 server = coa } server coa { recv-coa { update control { Home-Server-Pool := firebrick_pool } ok } send-coa { ok } } --- proxy.conf is currently: --- home_server firebrick-1 { type = coa ipaddr = 2.3.4.5 port = 3799 secret = password require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = none check_interval = 30 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server firebrick-2 { type = coa ipaddr = 1.2.3.4 port = 3799 secret = password require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = none check_interval = 30 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool firebrick_pool { type = load-balance home_server = firebrick-1 home_server = firebrick-2 } --- Any pointers would be gratefully received -- Richard Palmer

3 2

realm and @ in username
by Jonathan KHATTIR 06 Jan '14

06 Jan '14

Hi, I try to configure my proxy freeradius. The problem is that i have a "@" caracter in my username and i think that freeradi us interpret the realm after the @ caracter. But it's not the realm because i have a @ in the username. fr.wifimetropolis.com is my realm and alexandre.lai(a)idcware.com is my username. I would like send my requet in this format for exemple : fr.wifimetropolis.com/alexandre.lai@idcware.com but i test with radtest command, it's didn't work. Regards Cordialement, Jonathan Khattir Technicien Support Nomosphere jkhattir(a)nomosphere.fr

5 4

Re: default configuration no auth-type
by Rui Ribeiro 04 Jan '14

04 Jan '14

> > Message: 7 > Date: Fri, 3 Jan 2014 23:00:06 -0600 > From: Michael Aldridge <aldridge.mac(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: default configuration no auth-type > Message-ID: > <CAL80pzRV6cSAU6H4FvnhUhFFR=VH0H5+JZ6DZAiWcqJ+j= > Le3w(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > hmm, works now. both files are mentioned in the startup of the system, but > only the one at /etc/freeradius/users is being used. well, at least all is > good now. > > > On Fri, Jan 3, 2014 at 8:13 PM, Alan DeKok <aland(a)deployingradius.com > >wrote: > > > Michael Aldridge wrote: > > > I think I am editing the correct file (/etc/raddb/users). > > > > Maybe. The debug output shows if it's reading that file. Reading it > > helps. > > > > > Here are the contents of the users file: > > > > > > testing Cleartext-Password := "password" > > > > Whatever the contents are, the server isn't reading that file. > > > > > Does the users file have to be owned by a specific user? I had to > > > manually create the raddb folder, if that signifies anything. > > > > Uh, yes. It means that the server isn't using that directory. It's > > using another one. > > > > Read the debug output to see which directory it's using. > > > > Honestly, all of this is in the debug output. Just read it. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > Hi Michael, Debian changes the default location of many utils, including freeradius. btw, if you are planning to use Debian for production, specially connecting with an AD, sooner or later you will have to compile it to the latest 2.2.x version. Regards, Rui Ribeiro

2 1

default configuration no auth-type
by Michael Aldridge 04 Jan '14

04 Jan '14

Having just completely purged and reinstalled freeradius, I cannot get the default configuration to work. Here is the output from a request in debug mode: rad_recv: Access-Request packet from host 127.0.0.1 port 59114, id=221, length=59 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 221 to 127.0.0.1 port 59114 The user and testing were performed following the guide found on the freeradius wiki here: http://wiki.freeradius.org/guide/Basic-configuration-HOWTO any help is greatly appreciated! -- the-maldridge aldridge.mac(a)gmail.com

4 7

Enable Perl module in combination with EAP/SIM module
by Shurbann Martes 04 Jan '14

04 Jan '14

Hi list, Just wondering if there is a way to enable the Perl module to work without changing the users files as described here http://wiki.freeradius.org/modules/Rlm_perl. This page describe that to enable the Perl module the users file needs to be changed by adding the following line: DEFAULT Auth-Type = Perl Fall-Through = yes In many places (http://wiki.freeradius.org/config/Auth%20Type) I'm reading that it is not a good idea to intervene by setting the Auth-Type manually, but still on the wiki page of rlm_perl this is being described as the way to enable the Perl module to work. Until now I've been using the Perl module alone to authenticate/authorize and changing the users file works great. But now I need to combine EAP/SIM module with Perl module. So when the message contains EAP/SIM attributes it needs to authenticate using EAP module, else it needs to fallback to the Perl one. With the users script changed as described on the perl_module page the EAP module won't work and if I don't change the users it will use EAP/SIM module, but Perl module will fail. So intervening here looks like is causing modules not to work properly Which strategy needs one to follow when using the Perl script in combination with EAP/SIM. Just want to be sure that I'm using the proper way to enable the Perl module, without intervening in the Auth-Type. Thanks you for your time. If you need me to add the default and the users file, just let me know. Regards, Shurbann Martes

4 11

All devices fail to connect via WIFI to my Radius server.
by Cesar SANCHO PRADEL 03 Jan '14

03 Jan '14

Hi, I am new to Radius so sorry in advance if my question has a simple obvious answer. I have a FreeRADIUS Server running on a linux box, with mySQL holding the list of users/passwords. radtest seems to work fine, but when I try to connect a laptop (Windows 7) or an iPad (iOS) via WIFI it does not work (they cannot connect). If I run freeradiusd -X, I can see all the steps taken during radtest, however when I try to connect with my laptop or iPad, there is no output from freeradius -X. My test network looks as follows: ISP | MY_ROUTER | MY_WIFI_ROUTER * Local IP: 192.168.200.1 * Model: LinksysWRT54GS * Wifi configuration shown below: - Security Mode: RADIUS - RADIUS Server Address: 198.162.200.100 - RADIUS Port: 1812 - Shared Key: 9F6A5757EF - Default Transmit Key: 1 - WEP Encryption: - Passphrase: admin | | MY_LINUX_BOX (connected by cable to MY_WIFI_ROUTER) * Fedora 12.04 * IP: 192.168.200.100 * RADIUS_SERVER in this BOX: FreeRadius v.2.1.10, for host x86_64-pc-linux-gnu, built on Sep 24 2012 at 17:58:57 I have modified the clients.conf adding: client router { ipaddr = 192.168.200.1 require_message_authenticator = no secret = 9F6A5757EF shortname = router nastype = cisco } client linuxBox { ipaddr = 192.168.200.100 require_message_authenticator = no secret = 9F6A5757EF shortname = linuxBox nastype = other } All seems to work if I run radtest usr pwd 192.168.200.100 1812 9F6A5757EF (where usr and pwd are stored in mySQL) Any other device that tries to connect fails silently (i.e. no debug info displaied), as if the radius server did not receive any request at all. My questions are: 1) Do I need a particular client application in the client machine or should I be able to connect directly from any device/OS? 2) Are the modifications to clients.conf correct based on my network? 3) The shared key I set in MY_WIFI_ROUTER (i.e. 9F6A5757EF) should match the "secret" set in the clientś.info, right? 4) Any ideas/help to be able to connect a device (e.g. my iPad or Laptop) via freeradius server would be appreciated. Thanks in advance Cesar

2 1

Triggering a Disconnect-Request
by Norman Elton 03 Jan '14

03 Jan '14

I know I can use radclient to send a disconnect message to a NAS. Is there any way to trigger the FreeRADIUS process to send a disconnect message instead? In my case, I have a FreeRADIUS server running happily, and an external script that sends disconnects. Right now, the script runs alongside FreeRADIUS on the same server. I would like to move that script elsewhere, but I would like to offload it to another server. Problem is, the NAS only honors requests from known RADIUS servers. If it receives the request from anywhere else, it is simply ignored. Ideally, my script would send some sort of message (something like a status message) that FreeRADIUS would turn around into a disconnect request. Any ideas? Thanks Norman

3 2

Group based Authentication with Apache module mod_auth_radius-2.0
by Finn Christiansen 03 Jan '14

03 Jan '14

Hi, I am using FreeRADIUS 2.1.12 with a MySQL database and an Apache 2.2.15 with the module mod_auth_radius-2.0 (http://freeradius.org/mod_auth_radius/) The module is loaded in the Apache configuration and it works for users with the following configuration: <Location /protected/> AuthType Basic AuthName "protected" AuthBasicAuthoritative Off AuthBasicProvider radius AuthRadiusAuthoritative on AuthRadiusActive On Require user foo </Location> This works and user "foobar" can login. Now I am trying to do the same with groups so i replaced the line "Require user foo" with "Require group bar" but this doesn't work. Is it possible to use group based authentication with this Apache module or am I missing something like adding some attributes to the group? I have to say I am mostly new to Radius in general but I couldn't find any help regarding mod_auth_radius-2.0 and group based authentication. Thank you for your help! Regards, Finn Christiansen

2 1

Re: Subject: Using radsniff to generate stats
by Rui Ribeiro 03 Jan '14

03 Jan '14

Hi Arran, I have read the page you refer, and you say FreeRadius has no idea about the dropped packets. Would it be possible, or interesting to modify FreeRadius to give directly stats also like for instance named provides an interface for retrieving statistics? How about performance of this particular solution of sniffing traffic? I wonder how much load? Granted, RADIUS traffic volume is particularly low, however, in linux, the packets have to be copied to userland to libpcap to use them, contrary to for example, FreeBSD. (Note: There is the PF_RING patch. I havent tested it out) Note: Dont take the comments personally, it is just in the past I have always favoured solutions that were an alternative to sniffing traffic. Regards, Rui On 3 January 2014 06:11, <freeradius-users-request(a)lists.freeradius.org>wrote: > > > Message: 2 > Date: Thu, 2 Jan 2014 19:50:21 +0000 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Using radsniff to generate stats > Message-ID: <C45652E4-7294-42FF-A79C-D5DCD2CCEDD6(a)freeradius.org> > Content-Type: text/plain; charset="us-ascii" > > If anyone's interested in how to do it: > http://wiki.freeradius.org/guide/stats-with-radsniff > > Will only work with radsniff from master branch, 3.0.x version is pretty > much the same as 2.0.x. > > If enough people want (and test) the new version of radsniff, it should > be pretty easy to port it to 3.0.x and get it into a released version > sooner. > > -Arran > > >

3 4